{"id":"CVE-2025-6019","published":"2025-06-19T11:55:57Z","modified":"2026-06-30T11:10:04Z","title":"Libblockdev: lpe from allow_active to root in libblockdev via udisks","vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","tier":"core","eol":null,"affectedVersions":[{"vendor":null,"product":null,"versions":["< 3.3.1"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7 Extended Lifecycle Support","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.2 Advanced Update Support","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Telecommunications Update Service","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","versions":["all versions"]}],"description":{"text":"A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the \"allow_active\" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an \"allow_active\" user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation.  However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":7,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.0048,"percentile":0.41463,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-10-09","exploitedFirstSeen":"2025-10-09","ransomware":false,"evidence":[{"url":"https://www.enisa.europa.eu/sites/default/files/2025-10/ENISA%20Threat%20Landscape%202025.pdf","date":"2025-10-09"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-250","name":"Execution with Unnecessary Privileges"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2025:10796","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:9320","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:9321","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:9322","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:9323","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:9324","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:9325","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:9326","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:9327","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:9328","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:9878","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-6019","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2370051","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://cdn2.qualys.com/2025/06/17/suse15-pam-udisks-lpe.txt","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2025/06/17/5","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2025/06/17/6","tags":[]},{"url":"https://lists.debian.org/debian-lts-announce/2025/06/msg00018.html","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2025/06/18/1","tags":[]},{"url":"https://www.bleepingcomputer.com/news/linux/new-linux-udisks-flaw-lets-attackers-get-root-on-major-linux-distros/","tags":[]},{"url":"https://news.ycombinator.com/item?id=44325861","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-18685","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-18685","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":7,"skipped":4,"earliest":"2025-06-19","earliestUrl":"https://github.com/guinea-offensive-security/CVE-2025-6019","repos":[{"name":"guinea-offensive-security/CVE-2025-6019","url":"https://github.com/guinea-offensive-security/CVE-2025-6019","stars":71,"created":"2025-06-19"},{"name":"And-oss/CVE-2025-6019-exploit","url":"https://github.com/And-oss/CVE-2025-6019-exploit","stars":4,"created":"2025-06-20"},{"name":"neko205-mx/CVE-2025-6019_Exploit","url":"https://github.com/neko205-mx/CVE-2025-6019_Exploit","stars":3,"created":"2025-06-29"},{"name":"JM00NJ/CVE-2025-6019-udisks2-XFS-Resize-TOCTOU-Privilege-Escalation","url":"https://github.com/JM00NJ/CVE-2025-6019-udisks2-XFS-Resize-TOCTOU-Privilege-Escalation","stars":3,"created":"2026-02-13"},{"name":"symphony2colour/CVE-2025-6019-udisks-lpe-no-image","url":"https://github.com/symphony2colour/CVE-2025-6019-udisks-lpe-no-image","stars":1,"created":"2026-02-10"}]},"first":{"date":"2025-06-19","source":"PoC-in-GitHub","url":"https://github.com/guinea-offensive-security/CVE-2025-6019"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2025-06-19","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-6019","provenance":"source"},{"date":"2025-06-19","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/guinea-offensive-security/CVE-2025-6019","provenance":"source"},{"date":"2025-10-09","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.enisa.europa.eu/sites/default/files/2025-10/ENISA%20Threat%20Landscape%202025.pdf","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":53.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 388 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":8.29,"detail":"percentile 0.4146"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"7 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":4.9,"detail":"base score 7"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}